The DMZ

daya

04:39

@JourneymanGeek can you help me with uninstalling wsl?

In elevated command prompt it gives me the Error: 0x80070002

Or I should ask this on SU?

Because on internet, there are lot of articles regarding this error but they are associated with windows update NOT with wsl

I tried to uninstall using lxrun /uninstall /full

Journeyman Geek

@daya I've not really played with WSL

daya

05:04

Okay I will ask it on SU then

@JourneymanGeek Wtf, On SU, "You have reached your question limit"

Journeyman Geek

\o/

I think that's network wide

daya

Should I try in chat rooms of SU?

Journeyman Geek

05:51

no

Benoit Esnard

07:15

@Arminius My submissions on other challenges worked

Tom K.

whoa

ah

I just joined the room, Benoit says "it worked". I kinda felt like I have been summoned..

Benoit Esnard

I'm not sure if window.location is ignored by the bot, so I always load a new Image

@TomK. Haha

I will try to summon you on the CTF Slack

Tom K.

now?

Benoit Esnard

Right now.

Tom K.

:O

gah.. what's our workspace address?

got it

don't have my password here... :s

Benoit Esnard

07:21

sec-ctf.slack.com

Oh.

Tom K.

lul.. not even sure what email I used..

Benoit Esnard

It won't work then.

You used [email protected]

As far as I can tell :P

Tom K.

hm, weird

I thought so as well

Benoit Esnard

Try with "googlemail"?

Tom K.

but Slack says I don't have permission for this room

Benoit Esnard

07:25

Strange

I will send you an email to that address

Done :)

Tom K.

just changed my password

M'vy

There's so little time. I'd like to do some kind of CTF some day though

Tom K.

there's a lot of time at night @M'vy !

Benoit Esnard

You can join us whenever you want @M'vy!

Tom K.

just got your mail benoit

yay!

wow... Cisco really fucked up again

Arminius

07:35

@BenoitEsnard I tried some other XSS challenges. There the bot worked fine too. Maybe it's a bug

Benoit Esnard

Let's go to Slack to trade payloads then?

I'm not sure what the fuck is wrong with this challenge

The solutions we have are working in our browsers, we aren't exploiting any DOM XSS (I haven't found any, to be honnest), so I don't know what the fuck is happening :(

I will have another try this week-end, then I'll ping some people on their IRC channel

@Arminius Oh, and why are you awake that early?

You still haven't slept, right? :P

Arminius

Insomnia

:/

I'm in bed right now. Didn't manage to fall asleep for a few hours so I grabbed my phone, heh

Benoit Esnard

Do you know why you can't sleep?

M'vy

@BenoitEsnard what's the time investment required?

Arminius

@BenoitEsnard Not sure, it's been like that for years. Something wrong with brain chemistry I guess. But really not too uncommon in this channel...

30h days would be a good start

Tom K.

07:48

@M'vy there is none

Arminius

I'll see if I can get into my Slack account from mobile

Tom K.

@Arminius Maybe you should do things that make you tired

like.. read a lot of @forest's answers for instance

Arminius

Maybe if he audo-records them for me that could work

M'vy

Well, I could be interested. Should I ask an invite somewhere?

Benoit Esnard

@M'vy None. You can play the full 24 hours if you have time & knowledge, or you can also ignore this week-end and wait for another challenge

M'vy

07:50

I see

Benoit Esnard

@M'vy We need an email address to invite, due to the way Slack works

You can use a throwaway if you want

M'vy

Ah right

Benoit Esnard

It won't be useful in any way, it will just have a temporary link to the account creation

M'vy

Let me check which one I use in slack

I'm yves.stadler on the standard gmail extension

Benoit Esnard

The invitation has been sent!

You can remove your message from the chat if you want to.

We won't ever need it anymore. :)

M'vy

08:02

ah too late

Anonymous

09:12

@TomK. Oh, dear...

Tom K.

yep

Anonymous

Cisco are fantastic lol.

forest

10:33

@MweyaRuider Hey, at least it's better than stealing the passwords for profit!

Anonymous

11:07

Is anyone here?

Anonymous

I need some help..

Tom K.

sup @Joshua.J

Anonymous

I'm having issues converting this certificate.

Anonymous

It's driving me insane.

Anonymous

Why won't my Linux shell accept this command "-certfile"

Tom K.

11:15

don't want to be picky here, but that's probably a flag

what's the command?

Anonymous

Sorry I meant flag.

Anonymous

:p

Tom K.

are you trying to do this?

Anonymous

I'm trying to convert a PKCS7 into a PKCS12

Anonymous

But for some reason it doesn't like it.

Anonymous

11:19

> openssl pkcs12 -export -in certificate.cer -inkey privateKey.key -out certificate.pfx

Mweya Ruider

@forest True true :)

Anonymous

But for some reason, I get "unable to load private key"

Anonymous

Even though it's a .key in the same dir.

Anonymous

It would appear it doesn't like -inkey

Anonymous

I don't know why...

Tom K.

11:22

not sure, never converted certificates

found this: support.pingidentity.com/s/article/…

Anonymous

Hmm, it's really strange.

Tom K.

and they use

> openssl pkcs12 -export -in PingFederate.pem -inkey PingFederate_private.key -out PingFederate.p12 -certfile RootCA.pem -certfile Intermediate.pem

dunno if you need the intermediate, but the RootCA might be of interest

Anonymous

Yeah, I just get "unable to load private key"

Anonymous

This is annoying...

Anonymous

I hate certificate shit.

Anonymous

11:28

So much.

forest

12:16

@Joshua.J It's not able to accept -certfile when you pass it a cert?

openssl pkcs12 -export -in something.cer -inkey something.key -out something.pfx -certfile someca.cer

@Joshua.J I assume you created certificate.cer with openssl pkcs7 -print_certs -in certificate.p7b -out certificate.cer?

HamZa

Does anyone have experience with pingfederate? in the sense, is it "good" security-wise?

forest

12:37

Seems like a very complex system.

GUI administration, setup wizards...

forest

12:55

Quick question on site policy: If I answered a question but found out almost immediately after that it has an exact duplicate, should I delete my answer, or just keep the answer and mark the question as a duplicate as well?

daya

Why would you find a duplicate after answering the question?

forest

Because I posted an answer but forgot what a term stood for (I just remembered the acronym) so I searched it, and an exact duplicate was one of the first few results.

daya

I mean this has to done before answering and then mark question as duplicate

So imo you should keep the answer and mark as duplicate

forest

Yeah that's what I did. Thanks.

daya

No Problem!

Anonymous

13:01

God.

Anonymous

I'm really not used to working with certificates.

Anonymous

Wait a nightmare, seriously.

daya

@forest keeping your answer might also help future readers to find answer to that question more easily

Anonymous

I'm getting flustered because I've fucked this up twice now, lol.

Anonymous

And now I'm going back to the customer like a dickhead with a new CSR, Christ.

forest

13:03

heh

I hope you weren't dealing with his private keys...

Anonymous

No.

Anonymous

I'm just confusing myself.

Anonymous

And applying certificates to the ASA is pretty confusing on its own.

forest

ASA hardware is stupid anyway.

Anything with IOS software is dumb.

Benoit Esnard

@forest I also posted a question which had a duplicate a few months ago, because I haven't used the exact same terms as in original question. I marked it as duplicated, and found out that SE has deleted my question 30 days later since it wasn't useful anymore

Anonymous

13:27

Yeah, I know.

Anonymous

I'm going to have to generate a new CSR now.

forest

@forest: IME there is an awful lot of misinformation and false claims made about, and in the name of "Security". Simply changing the context of a tool can completely undermine its purpose. Since the OP explicitly states a requirement for a "plug and play" solution, I infer that he/she has not considered the applicability nor impact of this to his/her implementation. Your dismissal of concerns raised by authoritative players in the Security domain as "uninformed" is not a very helpful approach. — symcbean 10 mins ago

lol apparently the TrueCrypt devs are now "authoritative players in security" :D

Tom K.

13:46

Hm.. are questions about SQLi really ontopic here?

0

Q: Why Group by & HAVING clauses doesnt work?

I was testing my application for SQL-injection attacks , here is the source code <?php //including the Mysql connect parameters. include("../sql-connections/sql-connect.php"); error_reporting(0); // take the variables if(isset($_GET['id'])) { $id=$_GET['id']; //logging the connection parameters...

Benoit Esnard

SQLi is related to hacking, isn't it?

Tom K.

yeah, but isn't this pretty much "how do I write a sql query?"

forest

Why would they not be on-topic?

@TomK. Not really. SQLi won't necessarily let you use an arbitrary query.

Benoit Esnard

@TomK. Yeah

This question is off-topic to me

Tom K.

Ha!

you two can fight it out, I'll have a smoke

Benoit Esnard

13:49

The query he tried won't work even without any filter

forest

(I haven't read that exact question, just talking about SQLi in general).

Benoit Esnard

You can't escape @forest. We need to fight now.

Are we doing it?! Now?! Right here?!

Anonymous

I hate messing things up at work.

Anonymous

I just made myself look so incompetent.

Anonymous

I generated three CSRs to get this to work.

Anonymous

13:55

Oh fucking dear.

Anonymous

I'm sad...

Tom K.

it's called learning on the job @Joshua.J

the important thing is, that you now know more than you did before

Benoit Esnard

There's nothing wrong with gaining knowledge through failing.

Tom K.

rfc-editor.org/rfc/rfc8461.txt

SMTP MTA Strict Transport Security (MTA-STS) is a mechanism enabling
mail service providers (SPs) to declare their ability to receive
Transport Layer Security (TLS) secure SMTP connections and to specify
whether sending SMTP servers should refuse to deliver to MX hosts
that do not offer TLS with a trusted server certificate.

the new https everywhere for mail

Anonymous

14:12

@BenoitEsnard I know.

Anonymous

But the customer doesn't see it like that.

Anonymous

The customer just sees it as the fact I took two hours to put a certificate on their ASA.

Anonymous

So I do agree Tom, it is learning on the job but the fact is, it took me a long time sort this out/

Anonymous

And now they're mad.

AndrolGenhald

14:35

"SMTP MTA-STS attempts to protect against an active attacker trying to intercept or tamper with mail between hosts that support STARTTLS."
That's an improvement, but what if I don't trust all the hosts it goes through?

I wish some of the actual end to end encrypted email attempts took off more, but key distribution is difficult :(

Anonymous

14:48

0

Q: How do I instruct our network engineer to secure connection from BYOD to our organization?

We read the NIST paper about securing BOYD, but it's just a long document according to our network engineer. He refuses to use it as a guide while asking to have a checklist. According to him, the checklist will help to go over the security requirements and decide which of the points from the che...

network nist byod

Anonymous

This will only cause discussion IMO

Anonymous

That was the fastest deletion I've seen in my life.

Anonymous

"AES-256 is currently no more secure than AES-128."

Anonymous

Surely that is not actually true.

Benoit Esnard

I haven't seen the question

But about that claim, I think I've already read somewhere that AES-128 was better for AES-256 for reasons I can't explain

Anonymous

14:58

0

Q: Does using AES-256 encryption really grant any further security?

AES-256, as far as I know, generates an 256 bit key to encrypt a message, and the 256-bit key is generated by a known algorithm starting from the password the user chooses. Since the encryption is symmetrical, though, any user inputting the same password will be able to generate an equal 256-bit ...

aes

Anonymous

"AES-256 is currently no more secure than AES-128."

Benoit Esnard

But don't trust my memory and search real cryptographers' opinions :)

Anonymous

Well, that's a different thing Benoit.

Anonymous

This user isn't saying AES-128 is better, he's saying it provides the same security as 256.

Anonymous

Which I am not sure I believe...

Benoit Esnard

15:01

141

A: Why most people use 256 bit encryption instead of 128 bit?

Why do people buy red sport cars ? They do not go faster than sport cars of any other colour... AES comes with three standard key sizes (128, 192 and 256 bits). Many people see this and think that if there are three distinct sizes instead of just one, then there must be some difference, and sinc...

See also:

20

A: Does AES-192 provide better encryption than AES-256?

Related-key attacks are interesting mathematical properties of algorithms, but have no practical impact on security of encryption systems, as long as they are used for what they were designed, i.e. encryption (and not, for instance, as building blocks for hash functions). Bigger is not necessari...

dckuehn

15:26

Hey guys, new here, can I ask a general cookie question or is that considered "software support" ?

Benoit Esnard

What is your question? :o

It's hard to tell from "general cookie question" if it will be on-topic or not.

dckuehn

Fair enough. I guess generally when expiring cookies, what stops someone who has acquired a previously valid cookie from adding it to their browser and maintaining authorization to a site?

Benoit Esnard

It's a valid question. :)

dckuehn

To rephrase, a hacker gets an authorized cookie, that cookie is subsequently expired, does that expiration affect the cookie as it was when the hacker obtained it?

Benoit Esnard

Not sure if there's a duplicate though

dckuehn

15:29

I wasn't sure how to ask it so I probably did a bad job googling

Arminius

The site keeps track of a session cookie's validity span and will discard/invalidate it after that

Benoit Esnard

@dckuehn I googled some keywords and haven't found anything

dckuehn

Our site in this case is .net, so the framework itself will keep track that the cookie is no longer valid?

Benoit Esnard

The answer posted by @Arminius is valid, but you should still post it in my opinion, as other people will see it

dckuehn

Ok cool, I'll do that. Thanks

Benoit Esnard

15:32

Yes! Most cookies encode the creation / expiration time in the value, so they can check whether it has expired or not.

dckuehn

Well I guess that gets back to the original question. If the original cookie had an expiration of 1 hour but the user logs out after 10 minutes, the "original cookie" still has an exiration of 1 hour, so the hacker with the "first cookie" can still add it to their browser and use it for 50 minutes?

But that goes back to @Arminius point that the site would keep track and know that the cookie has expired?

Benoit Esnard

There's different ways to handle that, and indeed keeping a list of revoked cookies is a solution

Update 張啟元 (Chang Chi-yuan) has cancelled his plans to hack Mark Zuckerberg The power of #bugbounty it's real.

Tweeted by phwd on September 28, 2018 at 1:59 PM

Arminius

sigh

dckuehn

I did post a question here: security.stackexchange.com/questions/194679/… , let me know if I can be more clear

Anonymous

16:07

Well, this weekend is basically the final push.

Anonymous

Tomorrow I need to sit a practice-test and decide whether I am going to push the NA-Sec back or not.

Anonymous

I was close to passing the first time but I am really not that confident, especially on the configuration of authenticated routes, they were a nightmare to lab in Packet Tracer the first time.

Anonymous

So I am not looking forward to it at all.

Arminius

What's NA-Sec for again?

Anonymous

Cisco Certified Network Associate in Security.

Arminius

16:10

Ah

Anonymous

So firewalls, IPS, IDS and routers acting as a firewall basically.

Anonymous

But all Cisco stuff, lol.

Anonymous

Then I will be a two-time CCNA welps - and I got my company to agree that I am doing OSCP next and not another Cisco exam so that's nice.

Anonymous

I can finally take an exam I actually want to do.

Arminius

I wonder how easily you can just offer certifications for stuff

Or if there are legal hurdles

daya

16:40

How much cryptography should I know to become a pentester?

Arminius

Depends on what you're pentesting

daya

More specifically, I don't want to deal with complex mathematics(which most cryptographers do)

I would want to pentest a web app and a network

Arminius

You don't necessarily need an in-depth knowledge of crypto for that. However, there may always be parts where it's really helpful. Or where you should at least know about common pitfalls

daya

Exactly

Arminius

You'll eventually find custom session cookie implementations etc.

daya

16:46

Is this for me?

Arminius

You might find that as part of a webapp pentest

daya

@Arminius I want to know which topics should I learn from a pentester's point of view? As you know we don't really need to master it.

Arminius

Hmm I find that hard to summarize

daya

in.udacity.com/course/applied-cryptography--cs387 would be good or too advanced?

Arminius

I didn't find a content summary for that course

daya

16:56

You need to sign in

I am sorry but check this please..

Arminius

Maybe someone else here has some better tips. What I'm thinking is, you should e.g. know about padding oracles, but you don't need to dissect a Feistel cipher. It should be okay to know for what use cases SHA1 is broken without understanding why it is. I think you can get far in areas of pentesting without explicitly focusing on crypto and pick up knowledge along the way

daya

Yes, got it!

Thank you @Arminius

Arminius

I had a look at the Udacity course but didn't find a course summary after logging in

Looks pretty high level to me though

daya

Yeah, they don't provide course summary

But in lessons you can view chapters to see the contents

Arminius

Actually, after skimming over the content, I like it. Seems like a practical, reasonably basic overview

I would expect a pentester to know that stuff

daya

17:12

Anyway, I will just try to understand the concepts from security point of view without necessarily falling into it's mathematics

Arminius

AFAICS it doesn't even go much into attacks, mostly how different cryptographic schemes work, etc.

daya

Indeed

Anonymous

I think Arminius is right.

Anonymous

You don't need to really know a lot of Crypto.

Anonymous

Just the basics on common algorithms, hashing, salting, etc, etc should be fine.

Anonymous

17:22

If you're learning how to pen-test web-apps it would be useful to learn how TLS/SSL sessions work.

Anonymous

And how the server communicates with the client over TLS/SSL

Anonymous

And of course the crypto side of those so what crypto functions they actually use.

Anonymous

And their implementation I guess.

daya

17:44

Yeah, thanks @Joshua.J

Anonymous

20:32

I love getting FGITW'd

Arminius

What question?

Anonymous

Doesn't matter :p

Anonymous

Was just a free rep question.

Anonymous

But eh, oh well.

Benoit Esnard

22:41

Wow, that FB bug looks great.

Transcript for